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What is claimed is: 

1 . A computer-implemented method for obtaining information about a 
shutdown of a computer, the computer having at least one user-mode process, the 
method comprising: 

presenting a user with a plurality of reasons for the shutdown of the computer; 
receiving a user selection of at least one of the plurality of reasons; 
storing the selected reason in the memory; and 
capturing the state of the user-mode process for subsequent analysis. 

2. A computer-readable medium having stored thereon computer- 
executable instructions for performing the method of claim 1 . 

3 . The method of claim 1 , further comprising: 
retrieving the plurality of reasons from a system database; and, 
presenting the retrieved reasons to the user. 

4. The method of claim 3, wherein the reasons are retrieved from entries 
located in a system database, wherein each reason entry indicates whether the reason 
is to be displayed during a shutdown of the computer, or during a restart of the 
computer following a shutdown. 

5. The method of claim 1 , wherein at least one of the plurality of reasons 
is user-configurable. 
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6. The method of claim 1 , further comprising: 

receiving from the user a typed-in description of at least one reason for the 
shutdown; and, 

storing the typed-in description in the memory. 

7. The method of claim 1, further comprising: 

receiving from the user a selection of whether the shutdown was planned or 
unplanned; and, 

storing the planned or unplanned selection in the memory. 

8. The method of claim 1 , wherein the user initiates the shutdown of the 
computer and selects one or more reasons for shutting down the computer at a remote 
computer that is in communication with the computer being shut down. 

9. The method of claim 1 , further comprising prompting the user to enter 
the shutdown reason in response to the user initiating a shutdown of the computer. 

1 0. The method of claim 1 , further comprising prompting the user to enter 
the shutdown reason in response to the user restarting the computer subsequent to the 
computer being shutdown. 
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1 1 . The method of claim 1 , wherein the reason is received via a command 
Hne interface. 

12. The method of claim 1 1 , wherein the reason is received in the form of a 
reason code. 

13. The method of claim 1 , further comprising receiving a user indication 
of a remote machine that is being shutdown. 

1 4. The method of claim 1 , further comprising: 

determining, based on the user specified selection, whetiier the shutdown is 
planned or unplanned; and 

if the shutdown is determined to be unplanned, performing the capturing step. 

15. A computer-implemented metiiod for obtaining information about a 
shutdown of a computer, the method comprising: 

at a command-line interface, receiving a user entry of a command to shut 
down the computer along with at least one shutdoAvn reason code; 

searching a Ust of predefined shutdown reason codes to determine whether the 
entered shutdown reason code is recognized; 

if the entered reason code is recognized, storing the entered reason code in a 
memory; 
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if the entered reason code indicates that the shutdown is unplanned, taking a 
snapshot of the current state of each of a plurahty of user-mode processes; and 
storing the snapshot in a non-volatile memory. 

16. A computer-readable medium having stored thereon computer- 
executable instructions for performing the method of claim 15. 

1 7. The method of claim 1 5 , wherein the receiving step further comprises 
receiving the name of the computer that is being shutdown, and wherein the storing 
step further comprises storing the reason code on a memory of the named computer. 

1 8 . The method of claim 1 5 , wherein the receiving step further comprises 
receiving the name of the computer that is being shutdown, and wherein the storing 
step further comprises storing the snapshot on a memory of the named computer. 

19. A computer-implemented method for obtaining information about a 
shutdown of a computer, wherein the computer has a memory, the method 
comprising: 

receiving from a user a reason for shutting down the computer, wherein the 
reason is one of a plurality of predefined shutdown reasons; 

taking a snapshot of the state of all of the user-mode processes that are running 
on the computer at the time of the shutdown; and 

storing the received reason and the snapshot in the memory. 
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20. A computer-readable medium having stored thereon computer- 
executable instructions for performing the method of claim 19. 

2 1 . The method of claim 1 9, further comprising, in response to the user 
initiating the shutdown of the computer, prompting the user to enter the shutdown 
reason. 

22. The method of claim 19, further comprising, in response to the user 
rebooting the computer after an unexpected shutdown, prompting user to enter the 
reason for the unexpected shutdown. 

23 . A method for obtaining information about the shutdown of a computer, 
the method comprising: 

in response to a user initiating the shutdown of the computer: 
retrieving a Ust of preconfigured shutdown reasons from a database on the 
computer; 

presenting the list of preconfigured shutdown reasons to the user; 
prompting the user to select one or more of the preconfigured reasons; 
storing the selected preconfigured reason or reasons in a log file on the 
computer; 

if the selected shutdown reason indicates that the shutdown is unplanned, 
taking a snapshot of the current state of the user mode processes on the computer; 
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storing the snapshot on a non-volatile memory of the computer and, 
shutting down the computer. 



24. A computer-readable medium having stored thereon computer- 
executable instructions for performing the method of claim 23. 

25. The method of claim 23, further comprising: 

prompting the user to select whether the shutdown is planned or unplanned; 

and, 

storing the planned or unplanned selection in the log file. 



